The origin opens the connection, not the internet. Nothing needs to be exposed, no firewall rule needs to be written, and the address of the machine never appears anywhere.

In preview. The control plane and the API are in place; tunnels are being brought up with a small number of networks first. Ask if you want to be one of them.